Data classifiers such as neural networks typically operate by generating an element of output data in response to an element of input data. Such a data classifier may be constructed or trained using a training set of input and output data elements in such a way that not only is the data classifier able to reproduce, as accurately as possible, each element of output training data in response to each corresponding element of input training data, but it is also able to generate suitable elements of output data in response to new input data elements in a plausible and useful manner. Neural networks achieve this behaviour through the training of a plurality of interlinked neural nodes, usually constructed in software, but other schemes are known.
Data classifiers such as neural networks are commonly used in the detection of patterns or anomalies within large data sets. A particular application is that of detecting fraudulent activity on telecommunications networks, such as illicit emulation of a legitimate mobile telephone through cloning, tumbling or otherwise misusing a legitimate identification code.
An element of data for input to a data classifier may typically take the form of an input vector or similar data structure. Each input vector typically comprises a collection of parameters. In a telecommunications fraud detection system these may, for example, relate to total call time, international call time and call frequency of a single telephone in a given time interval. Each input vector is associated with an element of output data which may be as simple as a single parameter indicating the likelihood or ascertained fact that an input vector corresponds to fraudulent use of a telephone, or may itself take the form of a vector. A trained data classifier may then be considered to define a mapping between the input and output data elements.
A data classifier trained or constructed on the basis of a training set of such corresponding elements of input and output data should be able to reproduce the output data, in response to the input data, to a reasonable degree of accuracy. At the same time it will usually be important to maintain a good ability to respond in a suitable manner to new elements of input data, to retain sufficient flexibility to allow future retraining or adjustments in response to new training data and to minimise the time or other resources required in carrying out data classifier training or construction.
The balancing of these and other pertinent training factors is frequently achieved, especially in the case of neural networks, by use of a simple measure of difference between the “ideal” output data elements, usually defined by the training data set, and the data elements output by the data classifier in response to the input elements of the same data set. A commonly used measure of difference is the square root of the mean of the sum of these differences, often referred to as the “rms-error” of the data classifier, or a related measure of difference.
As a data classifier undergoes training the rms-error should reduce. It may be possible to reduce the rms-error to close to zero, but this is likely to lead to a data classifier that is very poor at generating reasonable output data elements in response to new input data elements, and that is impervious to retraining. The training process, therefore, may be halted when the rms-error reaches a predetermined threshold.
Alternatively, a subset of the training data may be kept aside and used in a separate determination of rms-error. When this separate determination of rms-error reaches a minimum and starts to rise again, training is stopped, even though the rms-error determined from the main body of training data would continue to fall. This latter method, while generally robust, has a significant drawback in that a sizeable proportion of the available training data is not actually used for training the data classifier, and such early stopping methods in general have been shown to significantly inhibit the process of training data classifiers for use in fraud detection.
The ability of a data classifier to identify patterns or characteristics in new input data differing considerably in magnitude or otherwise from the training data is particularly important for fraud detection. Particular scenarios of fraud identified within the training data may represent the most common fraud types, but variations on these scenarios may be wide ranging, and new methods and types of fraud are likely to emerge from time to time which may be only loosely related or indeed unrelated to familiar scenarios.
To some extent it is unrealistic to expect a data classifier such as a neural network to provide plausible outputs to new input data varying widely from the training data, but nevertheless, a significant degree of generalisation by a data classifier should be expected.